Server-Side Request Forgery Flaws in Flowise by FlowiseAI
CVE-2026-41272

7.1HIGH

Key Information:

Vendor

Flowiseai

Status
Flowise
Flowise-components
Vendor
CVE Published:
23 April 2026

What is CVE-2026-41272?

Flowise, a user-friendly interface for constructing custom large language model flows, harbors significant security weaknesses in its core functionalities. Versions prior to 3.1.0 are susceptible to Server-Side Request Forgery (SSRF) due to multiple logic flaws in the security wrappers, namely secureAxiosRequest and secureFetch. These flaws permit attackers to bypass configured allow/deny lists using techniques like DNS Rebinding or by leveraging insecure default configurations that fail to enforce any deny lists. The vulnerabilities have been addressed and mitigated in version 3.1.0.

Affected Version(s)

Flowise < 3.1.0

flowise-components < 3.1.0

References

https://github.com/FlowiseAI/Flowise/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.